One of the most important things you can do to make sure that you've got good security on your systems
is to make sure that you've got good physical hardening.
Now what I'm talking about physical hard to do and I don't mean pour concrete all over it or cover it
with steel plates.
Instead what I'm talking about is that your typical system is covered with ports and connections and
all kinds of stuff that either inadvertent or evil people can take advantage of.
So what we're going to be doing is talking about how to deal with that as well as talk about some of
the evil things that can happen with C-p use that need a little extra help.
So the first place I want to talk about more than anything else is removable media controls now.
I'm old school so I still like to have a CD DVD on my system but removable media is still a real issue.
Now the one thing I'm not talking about here is USP.
We'll save that for a little bit later.
What I am talking about is mainly optical media more than anything else.
It's a trick to be able to make sure that you can deal with this stuff.
What if you don't want people throwing CD-ROMs into their system and installing stuff.
Or worse yet what if the auto play kicks in and automatically does naughtiness.
Luckily for us there's very easy controls on this.
So what I want to do is we're going to handle this from the operating system level.
Do keep in mind if you want to do a lot of systems allow you to simply shut off optical media.
But let's do a little bit more elegantly to do that within Windows although every operating system has
something similar to this.
We're actually going to go into a local computer policy and configure it so that people can do only
certain things with their removable media.
So on this particular system here I'm going to run in and see
and I'm going to add myself a plug in
in this particular aspect I'm going use Group Policy objects just for my local computer
and what I've got is my local computer policy.
Now I need to stress right now that if I wanted to and you can do this with just about any operating
system I can set it up for the system as a whole so that nobody can do anything on optical media but
I could also set it up for individual users in this particular example I'm going to set it up for the
computer as a whole.
But keep in mind that every OS would let you set it up so that Mike Myers can never run executable files
on DVD stuff like that.
OK so first thing we're going to do is let's go into our computer configuration because I want to do
it for the whole computer and we'll go under administrative templates.
And it's come down here to system and scroll all the way to removable storage access.
There it is.
Now if you take a look here you can see we got a lot of very very tight controls here.
Floppy drives removable disk in this case we're talking about removable drives IDs CDs DVDs.
Let's just have fun let's just say I want to set it up so nobody can read any optical media on this
system you see right now it's not configured.
So I'm just going to fire this up and enable it.
And if I hit OK I've said it up in such a way that nobody is going to be able to read any optical media.
But let me go and turn that off because I'm just the kind of person who's going to forget which is go
to not configured.
And we've turned that back off.
So every operating systems a little bit different in terms of how it handles removable media controls
but in Windows it's done through a local computer policy.
Now the next thing I want to do under physical hardening is something called Data execution prevention
or DGP.
DP is a problem that was discovered a few years back where evil guys could actually execute programs
in certain parts of memory.
They weren't supposed to.
So this really is a hardware issue even though it seems to be that we only use software to fix it.
So let me show you were DTP sets at least within the world of Windows.
So the first thing I'm going to do is I'm going to type in system and under System we go to advanced
system settings and we click under performance and if you look right here this is data execution prevention
and you'll notice it's on for pretty much anybody who needs it.
DP by default is a good thing and there's very very few situations where people do not want to turn
off DGP.
However if you take a look on the screen here you can actually go in and add executable programs.
I've got to tell you he's been around for close to 10 years now and I have never once had to go in there.
However that's on the exams so you have been fully covered at least in terms of understanding how to
turn on or turn off.
DP Now the last one that I want to talk about when it comes to physical hardening is actually pretty
interesting.
Here we're going to be talking about disabling ports however to disable ports.
We're going to have to go into the bias so I'm going to point a camera right at the screen so you can
watch me do some biased changes already.
OK folks here we are in my EFI bias on this particular system.
And now keep in mind what I'm about to show you changes on every different bias.
So keep that in mind as I show you.
So on this particular bias we go into peripherals and when I'm looking for is I want to turn off ports.
So first of all I cannot actually turn off my U.S. ports and that's a big one.
A lot of people worry about.
It's a matter of fact.
There would be a lot of security people who would not like this particular motherboard.
However I can do this USP mass storage drivers support route.
You can see that I've got it disabled.
The reason it's disabled is somebody can plug in a USP device they can plug in a mouse and the mouse
will work.
But if they try to plug in a thumb drive to copy data it's not going to work for them.
So keep in mind all of these are easily toggled enabled and disabled.
So now people can start using the thumb drives again properly.
Let's go and turn that off.
The other thing we could do is we can turn off just about any port.
I'm not going to go showing you every different port we can turn off here.
But one of the things that I like to use our legacy ports on this particular motherboard it actually
still has a Sapir a serial port and a parallel port serial ports are particularly notorious for bad
guys to get into.
So I'm going to go ahead and disable that one as well.
And then that way I've got ports turned off.
So with all the different things we've seen and physical hardening the one thing I really can't stress
enough is shutting off those ports in law enforcement scenarios in a lot of high proprietary scenarios
not turning off ports and in particular U.S. ports is a recipe for I.T. Security Disasters.
And
and
and.